We now demonstrate how NFM helps adversarial robustness. By extending the analysis of [1]}, [2]}, we can relate the NFM loss function to the one used for adversarial training, which can be viewed as an instance of distributionally robust optimization (DRO) [3]}, [4]}, [5]} (see also Proposition 3.1 in [6]}). DRO provides a framework for local worst-case risk minimization, minimizing supremum of the risk in an ambiguity set, such as in the vicinity of the empirical data distribution.
